netdev - Re: selftests/bpf: arm64: test_verifier 13 "FAIL retval 65507 != -29 (run 1/1)"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <3707ef0b-010e-52b8-aff9-720d6a5e60ec@iogearbox.net>
Date:   Wed, 26 Feb 2020 15:59:44 +0100
From:   Daniel Borkmann <daniel@...earbox.net>
To:     Paolo Pisati <paolo.pisati@...onical.com>, bpf@...r.kernel.org
Cc:     Alexei Starovoitov <ast@...nel.org>,
        Zi Shen Lim <zlim.lnx@...il.com>,
        Martin KaFai Lau <kafai@...com>,
        Song Liu <songliubraving@...com>, Yonghong Song <yhs@...com>,
        Andrii Nakryiko <andriin@...com>, netdev@...r.kernel.org
Subject: Re: selftests/bpf: arm64: test_verifier 13 "FAIL retval 65507 != -29
 (run 1/1)"

On 2/26/20 2:44 PM, Paolo Pisati wrote:
> This particular selftest fails on arm64 (x86-64 is fine):
> 
> $ sudo ./tools/testing/selftests/bpf/test_verifier -v 13
> #13/p valid read map access into a read-only array 2 , verifier log:
> 0: (7a) *(u64 *)(r10 -8) = 0
> 1: (bf) r2 = r10
> 2: (07) r2 += -8
> 3: (18) r1 = 0xffff00becd0d8c00
> 5: (85) call bpf_map_lookup_elem#1
> 6: (15) if r0 == 0x0 goto pc+6
>   R0_w=map_value(id=0,off=0,ks=4,vs=48,imm=0) R10=fp0 fp-8_w=mmmmmmmm
> 7: (bf) r1 = r0
> 8: (b7) r2 = 4
> 9: (b7) r3 = 0
> 10: (b7) r4 = 0
> 11: (b7) r5 = 0
> 12: (85) call bpf_csum_diff#28
>   R0_w=map_value(id=0,off=0,ks=4,vs=48,imm=0)
> R1_w=map_value(id=0,off=0,ks=4,vs=48,imm=0) R2_w=inv4 R3_w=inv0 R4_w=inv0
> R5_w=inv0 R10=fp0 fp-8_w=mmmmmmmm
> last_idx 12 first_idx 0
> regs=4 stack=0 before 11: (b7) r5 = 0
> regs=4 stack=0 before 10: (b7) r4 = 0
> regs=4 stack=0 before 9: (b7) r3 = 0
> regs=4 stack=0 before 8: (b7) r2 = 4
> last_idx 12 first_idx 0
> regs=10 stack=0 before 11: (b7) r5 = 0
> regs=10 stack=0 before 10: (b7) r4 = 0
> 13: (95) exit
> 
> from 6 to 13: safe
> processed 14 insns (limit 1000000) max_states_per_insn 0 total_states 1
> peak_states 1 mark_read 1
> FAIL retval 65507 != -29 (run 1/1)
> 0: (7a) *(u64 *)(r10 -8) = 0
> 1: (bf) r2 = r10
> 2: (07) r2 += -8
> 3: (18) r1 = 0xffff00becd0d8c00
> 5: (85) call bpf_map_lookup_elem#1
> 6: (15) if r0 == 0x0 goto pc+6
>   R0_w=map_value(id=0,off=0,ks=4,vs=48,imm=0) R10=fp0 fp-8_w=mmmmmmmm
> 7: (bf) r1 = r0
> 8: (b7) r2 = 4
> 9: (b7) r3 = 0
> 10: (b7) r4 = 0
> 11: (b7) r5 = 0
> 12: (85) call bpf_csum_diff#28
>   R0_w=map_value(id=0,off=0,ks=4,vs=48,imm=0)
> R1_w=map_value(id=0,off=0,ks=4,vs=48,imm=0) R2_w=inv4 R3_w=inv0 R4_w=inv0
> R5_w=inv0 R10=fp0 fp-8_w=mmmmmmmm
> last_idx 12 first_idx 0
> regs=4 stack=0 before 11: (b7) r5 = 0
> regs=4 stack=0 before 10: (b7) r4 = 0
> regs=4 stack=0 before 9: (b7) r3 = 0
> regs=4 stack=0 before 8: (b7) r2 = 4
> last_idx 12 first_idx 0
> regs=10 stack=0 before 11: (b7) r5 = 0
> regs=10 stack=0 before 10: (b7) r4 = 0
> 13: (95) exit
> 
> from 6 to 13: safe
> processed 14 insns (limit 1000000) max_states_per_insn 0 total_states 1
> peak_states 1 mark_read 1
> Summary: 0 PASSED, 0 SKIPPED, 1 FAILED
> 
> Above output without line wrapping: https://paste.ubuntu.com/p/qhCK8nJjKw/
> 
> Kernel version 5.4.21, config: https://paste.ubuntu.com/p/G3yxvvjRMS/

Yep, the csum_diff is broken for non-x86_64. Fix is wip on my side, will keep
you posted.

Thanks,
Daniel